Skip to main content

Reporting vulnerabilities

If you find a security problem in Zecnero software or infrastructure, report it privately. Don’t post it in public channels or open a public issue.

Email: zecnero@zecnero.org

TODO

Set up and publish a dedicated security contact (for example a security@ address), and confirm whether reports should be encrypted to the project key or a separate security key.

What to include​

  • What is affected: node, miner, wallet, pool, explorer, website or infrastructure.
  • Version or commit.
  • Steps to reproduce.
  • What an attacker could do with it.
  • How you’d like to be credited, if at all.

What happens next​

The team will confirm receipt, work on a fix and coordinate disclosure with you. Consensus fixes may ship as part of a network upgrade.

TODO

Publish target response times and the disclosure policy.

Rewards​

Valid reports can earn testnet rewards. See Bug bounty.